Ads By Man

Aggressive adware is a relatively standard PC threat nowadays, mainly because there are countless of techniques that adware may use to deploy itself to your computer. One of the most commonly used techniques involved bundled software, and this is one of the main reasons why adware infections are so common today. Ads By Man is another new piece of adware that may trouble users who were unlucky enough to install this adware while installing useful, cost-free software. If you see advertisements, banners, and pop-ups that are accompanied by text saying "Ads By Man", you probably have adware installed on your computer.

While adware can't perform any harmful activities, its presence can be quite annoying as it may ruin your online experience by flooding your web browser with ads, pop-ups, banners, and other elements used in online advertising. Apart from this, Ads By Man may also drop a tracking cookie on your computer to collect data such as geographic location, IP address, frequented websites, search queries, etc. These actions should be considered unwanted, and the software responsible for them should be eliminated immediately. We recommend taking care of the "Ads By Man" issue by using a reputable and updated anti-malware security application.

Table of Contents

Toggle

Analysis Report

General information

Family Name:	Adware.Dotdo
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 0cb8a2e9cba6963606d2bc7a7c45cab0 SHA1: a95ca3ccc3e8dd886deaed0cc9175926a2d9588e SHA256: CE13E5413BC2C71A1FAC4D6A4009C506311B6E2F330AF0CE57AA009142C3BF99 File Size: 176.65 KB, 176654 bytes

MD5: 3cefc1adc19ab614e59630a6a59b3bc1 SHA1: 812a1434d93f17899f3dcdb1dc6a9240785409ca SHA256: 8E2A7861BF07EACEEE20D1ADD1FD98E86B6D738E671940B4D5A55AA35AA5C0B7 File Size: 37.23 KB, 37227 bytes

MD5: 48097253866e0867d8f5ed3e876ca8f8 SHA1: f75eb82176c862e924d79e65e85763e55283047c SHA256: 59FA92AF53890E08837526359576B2002269803C9F39ED41B693A1167E48ACAA File Size: 183.09 KB, 183095 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

File Traits

• Installer Manifest
• nosig nsis
• No Version Info
• Nullsoft Installer
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\nsca6ad.tmp\simplefc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsca832.tmp\simplefc.dll	Generic Write,Read Attributes
c:\windows\ujoko	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\wagaukaz	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\run::kiernan	"c:\users\user\downloads\812a1434d93f17899f3dcdb1dc6a9240785409ca_0000037227" nzfdacwnzfdacwnzfdacwnzfdac.nzfdacbnzfdacinzfdacvn	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::grouping	"C:\Program Files (x86)\Federal\Ovens.exe" nzfdacwnzfdacwnzfdacwnzfdac.nzfdacbnzfdacinzfdacvnzfdac.nzfdacpnzfdacwnzfdac/nzfdacpc	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Wuktrlqd\AppData\Local\Ovens.exe" nzfdacwnzfdacwnzfdacwnzfdac.nzfdacbnzfdacinzfdacvnzfdac.nzfdacpnzfdacwnzfdac/nzfdacpc2v0v2v0vnzfdac0vi3vi2pc3nzfdacpcvhtmlzaZnzfdacrTNkUXteoDnzfdac4wEOs2D